# AI cuts cyberattack costs, putting slow-patching schools, hospitals and small firms at risk By John Kim Canonical URL: https://www.tokenpost.com/news/insights/50073 Published: 2026-11-06T12:22:01.000Z Updated: 2026-11-06T12:22:01.000Z Section: Insights & Views > An AI-assisted campaign breached 11 organizations in 26 seconds. Andreessen Horowitz says falling attack costs leave slow-patching schools, hospitals and small businesses increasingly exposed. An AI-assisted cyberattack breached 11 organizations in 26 seconds, highlighting how cheaper attacks are widening exposure for schools, hospitals and small businesses whose security updates lag behind. In its “The Exploit Was the Bottleneck” report published on 2026-11-05, Andreessen Horowitz described a campaign launched at the end of August by a single operator using hundreds of AI agents against print-management servers. GreyNoise counted 395 compromised organizations across 48 countries. Half were schools. The agents built a test environment, wrote exploits for two vulnerabilities disclosed four days earlier and obtained a target list from an internet scanning service. The first intrusion took less than four hours from an empty workspace. The attack used a cheap, open-weight model, according to the report. ![AI cuts cyberattack costs, putting slow-patching schools, hospitals and small firms at risk]() Source: Andreessen Horowitz Andreessen Horowitz argued that the time and expertise needed to turn vulnerabilities into working exploits had long constrained attacks. Work that took days or months now takes minutes or hours. AI also lowers the cost of scouting networks and moving through compromised systems, making hands-on attacks more economical against small organizations. Defensive timelines remain much longer. Verizon’s breach investigations report put the median time to fully remediate vulnerabilities exploited in attacks at 43 days, up from 32 days a year earlier. A quarter of the previous year’s industrial-control security advisories had no patch. Power-grid operators can spend 35 days assessing a patch and another 35 days deploying it. The report also examined two critical vulnerabilities in PHP, a programming language used by 70% of websites, that leaked before patches became available. Attack attempts appeared four days before disclosure. A week after disclosure, millions of attempts had yielded few confirmed compromises: reliable exploitation was difficult, and hosting providers and content networks blocked attacks within a day. ![AI cuts cyberattack costs, putting slow-patching schools, hospitals and small firms at risk]() Source: Andreessen Horowitz Yet between 2.6 million and 4.4 million internet-facing PHP installations remain, with about 80% running unsupported versions and several hundred thousand lacking a fix, according to Andreessen Horowitz. As attack costs fall, old blogs and small-business websites can become economical targets and serve as infrastructure for phishing, malware or subsequent campaigns. The authors did not expect the power grid or the internet to collapse. Instead, they anticipated outbreaks resembling WannaCry in 2017, with damage concentrated in systems that cannot be updated quickly and targets where a single intrusion can be worth billions of dollars.